How to file a DPPA private right of action

A federal law most officers don't know about

Someone pulled your DMV record without a permitted reason. A private investigator, a stalker with a contact at a contractor, a marketing firm. You can sue them in federal court. If you win, the minimum award is $2,500, and the court can order the defendant to pay your attorney's fees. The law is the Driver's Privacy Protection Act, a 1994 federal statute that limits what state DMVs and downstream resellers can do with driver data.

The bar to file is lower than most people think. Here's how to tell whether you have a case.

What the DPPA covers

The DPPA covers personal information that came from a state DMV. Name, address, photo, Social Security number, medical or disability information, and every field that flows out of vehicle and license records.

The statute lists 14 permitted uses for that data. Service of process. Insurance investigations. Court proceedings. Bulk research that doesn't identify you. A handful of others. If the use doesn't match one of the 14, the disclosure is unlawful.

The civil-liability provision is 18 U.S.C. § 2724. Anyone who obtains, discloses, or uses DMV-derived personal information for a purpose the statute doesn't permit is liable to you. That means liquidated damages of at least $2,500 per violation, actual damages if they run higher, punitive damages when the conduct was willful, and attorney's fees and costs. The fee provision is what gets lawyers to take the case.

The elements you have to prove

You have to prove three things.

The data came from a state DMV. A skip-trace report that lists your registered vehicle, your driver's-license address, or any field DMVs uniquely produce is enough to anchor it. A broker page that pulled the same address from voter rolls and property records is not. The data has to trace back to motor-vehicle records.

Someone obtained, disclosed, or used it. Pulling the record counts. Reselling it counts. Using it to send marketing or to track a person counts. The statute reaches all three.

The purpose wasn't on the permitted-use list. This is the contested element. Defendants will argue their use fits one of the 14 carve-outs: insurance investigation, court use, employer screening with notice, certain research. Read the list before you assume your case is clean.

How to gather evidence

Start with the artifact. The skip-trace report, the broker page, the email from a PI, the screenshot of a database query. Save it with a date and a URL. If a friend showed it to you, get a copy.

Pull your own DMV abstract. Most states let you request a record of who pulled your file, sometimes called a request log or audit history. It isn't always granted, but file the request and document the response. A log entry showing a non-government requester is strong evidence.

Document your damages. The statute gives you the $2,500 minimum without proof of actual harm. But if you can show the unlawful pull caused harassment, swatting, lost income, or a move, the actual-damages number can be much higher. Save text messages, voicemails, and the police report from any incident. A pattern of harassment after the pull is the kind of fact that drives settlement value.

Check whether the requester is a repeat player. PIs, marketing firms, and skip-trace companies often pull thousands of DMV records the same way. A class action sometimes makes more sense than a solo case. A plaintiff's-side data-privacy firm will know which targets have a track record.

Where to file

Federal court. The DPPA is a federal statute, and federal courts have jurisdiction under 28 U.S.C. § 1331. Pick the district where the defendant lives, where the unlawful act happened, or where you live and were harmed. Any of the three usually works.

Federal court is the natural home for a federal claim. State courts may have concurrent jurisdiction over a DPPA suit, but federal court is where the statute is best understood and where the fee-shifting provision applies directly. Some states also have their own driver-privacy laws, but the DPPA is the primary federal tool for an unlawful DMV pull.

The statute of limitations runs four years, under the federal catch-all in 28 U.S.C. § 1658. Every federal circuit that has ruled starts that clock when the violation happened, not when you found out about it. The Eleventh Circuit adopted that occurrence rule in Foudy v. Indian River County Sheriff (2017), and no circuit has read a discovery rule into the statute. So a pull you learn about years later may already be time-barred. If you found a 2022 skip-trace report in 2026, get to a lawyer fast, because the window may be closing.

What damages look like in practice

The minimum award is $2,500 per violation. "Per violation" is the phrase that matters. Pulling your record once is one violation. Pulling it 12 times across two years may be 12 violations. Reselling it to three downstream buyers may be three more.

The catch is that federal courts disagree on what "per violation" adds up to. Some read the $2,500 floor as attaching to each separate pull. Others let a court award a single $2,500 even when a defendant violated the statute many times over. In Ela v. DeStefano (11th Cir. 2017), a jury found 101 violations and the plaintiff asked for $252,500, but the court awarded $2,500 total. The difference between those readings is enormous, so ask your lawyer how your circuit comes down before you file.

Punitive damages can be added on top when the defendant acted willfully or in reckless disregard of the law. Attorney's fees are separate again. The court can order the defendant to pay your lawyer's hours plus costs, which is what makes these cases economical for plaintiffs' counsel even when the underlying damages are modest.

How a case comes together

Here is an illustration, not a specific case. An officer starts getting harassing texts. A scan turns up a recent DMV-derived skip-trace listing. The pull traces back to a private investigator hired by a defendant in a case the officer worked.

The PI claims an "investigation" use. The officer's lawyer argues the investigation served a personal grudge, not a permitted DPPA purpose. If the federal court agrees the use was unlawful, the PI owes at least $2,500 plus the officer's attorney fees.

Many of these cases settle rather than go to trial. The leverage is the attorney fees, which grow the longer the defendant fights.

What this doesn't do

The DPPA only covers DMV-derived data. It doesn't reach voter rolls, property records, court files, or commercial credit data. If your address showed up on a people-search site because your county recorded a deed in 2014, that isn't a DPPA case. Different sources, different statutes.

The DPPA also doesn't force a takedown. The lawsuit recovers damages. It doesn't compel the broker to remove your record from the live site. For that, you still file a broker opt-out request or, if you're in New Jersey, a Daniel's Law demand.

The case doesn't reach federal officers' federal personnel records either. Those run through agency-side privacy rules and the Privacy Act of 1974, not the DPPA.

Where this fits

The DPPA is the tool for unlawful DMV disclosure. Most officers will never need it. Some will need it the day they discover their address was pulled and sold to a problem.

Run a free scan to see what's currently exposed. If you find a DMV-derived listing, pull the record's audit log if your state offers one, save the evidence, and talk to a privacy lawyer who's done DPPA work. With the artifact in hand, a lawyer can take it from there.

For the broader cleanup, the opt-out request letter handles individual broker takedown, and the state AG complaint template escalates when a broker ignores you. The DPPA is a separate tool. Use it when the disclosure was unlawful and the person who did it has assets worth suing for.